PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-74297 Linux CVE debrief

A vulnerability in the Linux kernel's RDMA/mlx5 component allows for undefined behavior when shifting user RQ WQE size. This issue arises from the set_rq_size() function, which computes the RQ WQE size based on a user-provided rq_wqe_shift value. The rq_wqe_shift value is only checked to ensure it is greater than 32, but shifts of 31 or 32 can lead to undefined behavior or overflows. Attackers with local access and low privileges could potentially exploit this vulnerability to cause a denial of service or other impacts.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-15
Original CVE updated
2026-10-16
Advisory published
2026-08-15
Advisory updated
2026-10-16

Who should care

Linux system administrators, security teams, and developers should assess exposure and prioritize patching. Deployment contexts using RDMA/mlx5 in Linux kernels may be affected. Verify inventory, apply patches, and monitor logs for anomalies.

Why it matters

CVE-2026-74297 is a high-severity vulnerability in the Linux kernel's RDMA/mlx5 component. Local attackers with low privileges could exploit this issue to cause denial of service or other impacts. Linux system administrators and security teams should prioritize patching and verify system inventory.

  • Denial of service due to undefined behavior
  • Potential local privilege escalation
  • System crashes or instability from overflows
  • Verification of patch application required

Technical summary

The Linux kernel's RDMA/mlx5 component is vulnerable to undefined behavior when shifting user RQ WQE size. The set_rq_size() function computes the RQ WQE size as '1 << rq_wqe_shift' based on user input, which can lead to overflows or undefined behavior for shifts of 31 or 32. This issue can be triggered by local users with low privileges, potentially causing denial of service or system instability. Affected Linux system administrators and security teams should prioritize patching and verify system inventory to mitigate potential impacts.

Defensive priority

High

Recommended defensive actions

  • Review and apply patches from Linux vendors
  • Restrict access to vulnerable systems
  • Monitor system logs for anomalies
  • Verify inventory of systems using RDMA/mlx5
  • Apply compensating controls for exposed systems
  • Track exceptions and retest remediated assets
  • Review asset inventory for potential exposure

Evidence notes

The CVE record and associated source item provide details about the vulnerability, including its description, affected versions, and references to source code changes. However, there is limited information about potential exploits or specific attacks.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-74297 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-74297

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-74297 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-74297

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • RDMA/mlx5: Fix undefined shift of user RQ WQE size

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/74xxx/CVE-2026-74297.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9fff54929cc00849d738faa99f06c32399aeb026

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b746f949c2ac2b041102836095d6d4a2ef21fa75

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c1dbf52d24a8cb1aa56780ba51b72e7d495f258c

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6fc874fdfb366bfb11c62e6af9a831c8be59ddda

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/42f3d2c8c18b92ea33e506a38b64f1a8986c2823

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4b87a2497276a72fd63028e7419abf0fb7ed837b

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b732db02a2b04cde393638df19de6251ce62a74e

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.